healer | c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exe
Size

875KB
MD5

5725be0623806095e41027f57e2e28f4
SHA1

3f86d842e5ce649f780811b6789dbeb0c6425fa9
SHA256

c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0
SHA512

753954c7e39a83a53d38d9a21509702fc6a48f7da6f955f821760b852b10f5b6570f69bd76fd9a04f56acaf6655302489e6bf522d98e35adc40cbb7044b373d1
SSDEEP

24576:2yl/qu0Akf5E0qeZHCCh1c4gOuiof5hvS:Fx6Akf5E0EWm6sv

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0008000000023ca7-19.dat	healer
behavioral1/memory/2248-22-0x0000000000F40000-0x0000000000F4A000-memory.dmp	healer
behavioral1/memory/1612-29-0x0000000004A00000-0x0000000004A1A000-memory.dmp	healer
behavioral1/memory/1612-31-0x0000000004B70000-0x0000000004B88000-memory.dmp	healer
behavioral1/memory/1612-32-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-39-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-57-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-55-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-54-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-51-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-50-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-47-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-45-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-43-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-41-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-37-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-35-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-33-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer
behavioral1/memory/1612-59-0x0000000004B70000-0x0000000004B82000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

c28gy36.exeb6774WU.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c28gy36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c28gy36.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b6774WU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b6774WU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b6774WU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b6774WU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c28gy36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b6774WU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b6774WU.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c28gy36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c28gy36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c28gy36.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3972-67-0x0000000004A90000-0x0000000004AD6000-memory.dmp	family_redline
behavioral1/memory/3972-68-0x0000000007140000-0x0000000007184000-memory.dmp	family_redline
behavioral1/memory/3972-72-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-74-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-70-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-69-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-78-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-76-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-102-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-100-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-98-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-96-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-94-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-92-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-90-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-88-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-86-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-84-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-82-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline
behavioral1/memory/3972-80-0x0000000007140000-0x000000000717E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

Processes:

tice8767.exetice5811.exeb6774WU.exec28gy36.exedGOWL24.exe

pid	Process
648	tice8767.exe
1524	tice5811.exe
2248	b6774WU.exe
1612	c28gy36.exe
3972	dGOWL24.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

c28gy36.exeb6774WU.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c28gy36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b6774WU.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c28gy36.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exetice8767.exetice5811.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice8767.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice5811.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
5028	1612	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exetice8767.exetice5811.exec28gy36.exedGOWL24.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice8767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice5811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c28gy36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dGOWL24.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b6774WU.exec28gy36.exe

pid	Process
2248	b6774WU.exe
2248	b6774WU.exe
1612	c28gy36.exe
1612	c28gy36.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b6774WU.exec28gy36.exedGOWL24.exe

description	pid	Process
Token: SeDebugPrivilege	2248	b6774WU.exe
Token: SeDebugPrivilege	1612	c28gy36.exe
Token: SeDebugPrivilege	3972	dGOWL24.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exetice8767.exetice5811.exe

description	pid	Process	procid_target
PID 4116 wrote to memory of 648	4116	c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exe	83
PID 4116 wrote to memory of 648	4116	c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exe	83
PID 4116 wrote to memory of 648	4116	c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exe	83
PID 648 wrote to memory of 1524	648	tice8767.exe	84
PID 648 wrote to memory of 1524	648	tice8767.exe	84
PID 648 wrote to memory of 1524	648	tice8767.exe	84
PID 1524 wrote to memory of 2248	1524	tice5811.exe	85
PID 1524 wrote to memory of 2248	1524	tice5811.exe	85
PID 1524 wrote to memory of 1612	1524	tice5811.exe	96
PID 1524 wrote to memory of 1612	1524	tice5811.exe	96
PID 1524 wrote to memory of 1612	1524	tice5811.exe	96
PID 648 wrote to memory of 3972	648	tice8767.exe	101
PID 648 wrote to memory of 3972	648	tice8767.exe	101
PID 648 wrote to memory of 3972	648	tice8767.exe	101

C:\Users\Admin\AppData\Local\Temp\c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exe
"C:\Users\Admin\AppData\Local\Temp\c24eedadf25261e82c668428533bf9b1170b4d0cf59b883203dc020760a386a0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice8767.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice8767.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5811.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5811.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6774WU.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6774WU.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c28gy36.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c28gy36.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1080
        5⤵
        Program crash
        
        PID:5028
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dGOWL24.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dGOWL24.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1612 -ip 1612
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice8767.exe

Filesize
730KB

MD5
8b99408b6c2f1609fa3ecd101fd091b9

SHA1
29812140c381086875424f0fdafa77afefb14ee7

SHA256
f9b0fed19773812aaefeb3810a089de24abc2b151dc4f12bdbf305411bcf57f3

SHA512
02098b61dfdc25f1205c209fa4c70d2a1022a62daeb3b21e81a858afbfaf32ef5e7dc05fbddaf14da71faade9a56db30b08f8e59a3f181113ec37998926b2f56

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dGOWL24.exe

Filesize
408KB

MD5
349d156530d46cd6946ead9c8142d3bd

SHA1
6fc4dba34d9d0315f54ecbfb76be9265066505d7

SHA256
51f86558e9d86cac1b9c2f614c792808253e02d29222ae5401afb59470a43ab3

SHA512
236d57708d80a7d98cad82e812d9f4c77f52c6c66fad04eabfb178db33ae9ca078bb5a9fdad69bf04c7fda5aa370bfebe88c42b332f9b79e4c847be9306cb4c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5811.exe

Filesize
365KB

MD5
d3335badd9f6b7e8b5df7691b828502d

SHA1
3383d4ec0c428f49cb99138565a7419f90483c2a

SHA256
1d4c41747c37356f65ce76ae057282436f1d616ace0c85aa161655bd6cd62c79

SHA512
ff4e170a14af471a76f8410f0b5a8ff402f3f5ae2f46f58e409fb7ff1cded8032ad331118953cdf7c4ee83313127cbe73324a6230724709d9c87860f6c94128c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6774WU.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c28gy36.exe

Filesize
350KB

MD5
3a82355d972e56bcaa6648740212fad2

SHA1
9058ab9d77697697fb0c320488ce3245c738df32

SHA256
ebe2e0cf396e56a797e611daf7949b6081aeb869fbfb2cf136cca7eaa20fbe3e

SHA512
b878f7b670571a11e7b1beaa5a383f58c6dd0b20bfdf2d383b3dbe7d28bbdbb1653235f9fabc88d52f8a93f57d9e10461ad20ba83465e94cffbe8c06b6a5de3c

Download Submit
memory/1612-60-0x0000000000400000-0x0000000002B1B000-memory.dmp

Filesize
39.1MB

Download
memory/1612-50-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-29-0x0000000004A00000-0x0000000004A1A000-memory.dmp

Filesize
104KB

Download
memory/1612-30-0x00000000073D0000-0x0000000007974000-memory.dmp

Filesize
5.6MB

Download
memory/1612-31-0x0000000004B70000-0x0000000004B88000-memory.dmp

Filesize
96KB

Download
memory/1612-32-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-39-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-57-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-55-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-54-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-51-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-43-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-47-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-45-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-62-0x0000000000400000-0x0000000002B1B000-memory.dmp

Filesize
39.1MB

Download
memory/1612-41-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-37-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-35-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-33-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/1612-59-0x0000000004B70000-0x0000000004B82000-memory.dmp

Filesize
72KB

Download
memory/2248-22-0x0000000000F40000-0x0000000000F4A000-memory.dmp

Filesize
40KB

Download
memory/2248-21-0x00007FFEED8A3000-0x00007FFEED8A5000-memory.dmp

Filesize
8KB

Download
memory/2248-23-0x00007FFEED8A3000-0x00007FFEED8A5000-memory.dmp

Filesize
8KB

Download
memory/3972-80-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-100-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-72-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-74-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-70-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-69-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-78-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-76-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-102-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-68-0x0000000007140000-0x0000000007184000-memory.dmp

Filesize
272KB

Download
memory/3972-98-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-96-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-94-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-92-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-90-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-88-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-86-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-84-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-82-0x0000000007140000-0x000000000717E000-memory.dmp

Filesize
248KB

Download
memory/3972-67-0x0000000004A90000-0x0000000004AD6000-memory.dmp

Filesize
280KB

Download
memory/3972-975-0x0000000007810000-0x0000000007E28000-memory.dmp

Filesize
6.1MB

Download
memory/3972-976-0x0000000007E30000-0x0000000007F3A000-memory.dmp

Filesize
1.0MB

Download
memory/3972-977-0x0000000007F40000-0x0000000007F52000-memory.dmp

Filesize
72KB

Download
memory/3972-978-0x0000000007F60000-0x0000000007F9C000-memory.dmp

Filesize
240KB

Download
memory/3972-979-0x00000000080B0000-0x00000000080FC000-memory.dmp

Filesize
304KB

Download